Extracted

• • Target

    JaffaCakes118_5ac7014da59c0892ded19e38229ea35b

  • Size

    859KB

  • MD5

    5ac7014da59c0892ded19e38229ea35b

  • SHA1

    ed10fbacdee7c3346874bd39139eeb695da828fb

  • SHA256

    96a3dbb2618087fc9f4a9904eb4a9c7e1133c76051173a0c09b972b16b2deafd

  • SHA512

    98761f00cd96a3e7ad1ccdf6cfbc701f5d8657664b951c823a2f69dda92b6d9734cbc9e7fb5b4e6334ac505a3e1d7fc53f96b5a727183cb279c5f4fe186947c3

  • SSDEEP

    12288:q7xfPAWQ0Rol1gwpJsBTVhrhIpKBl7dPYcx1chxk3IdZFGli1jwi0E604fp81Fls:q7xmPkFfhIytD3ifVrVFLbS

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2